2026-08-14_3ab6a11bb9ba11a31e629acb0df72bc3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_3ab6a11bb9ba11a31e629acb0df72bc3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 5.0MB
Sample260814-ml5lsa1epc
SHA256 7d4460466ecfa266d0d1efbb3796bea8644a8b186e400facc6bee18d4e6734e9
MD5 3ab6a11bb9ba11a31e629acb0df72bc3
SHA1 9dc224dbecb5a4ddfbd891c338d006efc1938f6c
SHA512 cd14464ce95c1ef64c076f4a52ff1a83db079ad6b13c7de0d73bcebe5d5cfa33dddec980282055969750955751f420928b06341be39d880b1b6f6cb370f00811
SSDEEP 3072:rVXpKjioLc3nMszZ2UQz5yrzGAeRqvigxv4T5tLU3U:NpK2oLinM8NQz5yrzbeRqvfxs
TLSH
T122361A23A46468F9C0FD83BC3D6EBB080FFEB2F19768157F519198E04136592A5C5A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_3ab6a11bb9ba11a31e629acb0df72bc3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-08-14_3ab6a11bb9ba11a31e629acb0df72bc3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 5.0MB

2026-08-14_3ab6a11bb9ba11a31e629acb0df72bc3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 781d835723223999dd4c1c02bea7ac10
SHA256 7d4460466ecfa266d0d1efbb3796bea8644a8b186e400facc6bee18d4e6734e9
MD5 3ab6a11bb9ba11a31e629acb0df72bc3
SHA1 9dc224dbecb5a4ddfbd891c338d006efc1938f6c
SHA512 cd14464ce95c1ef64c076f4a52ff1a83db079ad6b13c7de0d73bcebe5d5cfa33dddec980282055969750955751f420928b06341be39d880b1b6f6cb370f00811
SSDEEP 3072:rVXpKjioLc3nMszZ2UQz5yrzGAeRqvigxv4T5tLU3U:NpK2oLinM8NQz5yrzbeRqvfxs
TLSH
T122361A23A46468F9C0FD83BC3D6EBB080FFEB2F19768157F519198E04136592A5C5A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33684

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\jefoxic\pococaw\yufegasor58-butelu.pdb

kernel32

AllocConsole GetConsoleAliasExesLengthA FindResourceW BuildCommDCBAndTimeoutsA DeleteVolumeMountPointA GlobalAddAtomA GetCommState GetSystemWindowsDirectoryW CreateDirectoryW AddConsoleAliasW FindCloseChangeNotification FreeEnvironmentStringsA GetModuleHandleW GetTickCount CreateNamedPipeW GetConsoleAliasesA GetPriorityClass GetCurrencyFormatW LoadLibraryW GetExitCodeProcess IsProcessorFeaturePresent GetConsoleAliasW MultiByteToWideChar GetVolumePathNameA GetLastError InterlockedFlushSList SetComputerNameExA GetProcAddress VirtualAlloc BackupWrite RemoveDirectoryA EnumSystemCodePagesW SearchPathA InterlockedExchangeAdd OpenWaitableTimerW LocalAlloc SetConsoleWindowInfo FoldStringA GlobalFindAtomW DebugSetProcessKillOnExit UpdateResourceW VirtualProtect PeekConsoleInputA ReadConsoleInputW GetWindowsDirectoryW SetFileAttributesW LocalFileTimeToFileTime GetConsoleAliasesLengthW FindFirstFileW CreateFileA FillConsoleOutputCharacterA SetVolumeLabelA SetLastError GetModuleHandleA HeapAlloc Sleep ExitProcess GetStartupInfoW RaiseException RtlUnwind GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree HeapReAlloc HeapCreate WriteFile GetStdHandle GetModuleFileNameA HeapSize LoadLibraryA InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringA WideCharToMultiByte LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

LoadMenuW CharToOemBuffW ChangeDisplaySettingsW

gdi32

GetCharWidthA GetCharacterPlacementA GetCharABCWidthsFloatA GetBoundsRect

advapi32

CloseEventLog

shell32

ShellAboutW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_3ab6a11bb9ba11a31e629acb0df72bc3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

gdi32

advapi32

shell32

generic